portable-agent-layer 0.67.0 → 0.69.0

package/src/hooks/lib/ledger-hook.ts

@@ -6,8 +6,17 @@
  * tool the post-tool half ignores leaves a snapshot nothing ever claims.
  */
 
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
 import { normalizeToolUse } from "./agent";
-import type { LedgerOutcome } from "./ledger";
+import {
+  claimPending,
+  type LedgerEntry,
+  type LedgerOutcome,
+  reapStalePending,
+  recordAction,
+  savePending,
+} from "./ledger";
 
 /**
  * Edits and writes, which carry their own target in the call. A shell command's
@@ -16,12 +25,39 @@ import type { LedgerOutcome } from "./ledger";
  *
  * Reads and searches are excluded because they are queries, not actions, and a
  * ledger that logs them buries the changes among them.
+ *
+ * The four beyond edit and write are Copilot's own names for the same act — its
+ * runtime groups them as its file-editing tools, and it sends the command as
+ * the tool name rather than as an argument.
+ */
+const LEDGERED_TOOLS = new Set([
+  "edit",
+  "write",
+  "create",
+  "insert",
+  "str_replace",
+  "str_replace_editor",
+]);
+
+/**
+ * Copilot's CLI also writes through a patch, and one call of that edits however
+ * many files the patch names. Its targets live in the patch body rather than in
+ * an argument, so it is filtered separately and read by patchedTargets.
+ */
+const PATCHING_TOOLS = new Set(["apply_patch", "applypatch"]);
+
+/**
+ * The editor tool that changes a file also reads one, under a command argument.
+ * A read recorded as an action would put queries back in a log of changes.
  */
-const LEDGERED_TOOLS = new Set(["edit", "write"]);
+const READING_COMMANDS = new Set(["view"]);
 
 /** Agents disagree on the spelling; the value is the same file either way. */
 const TARGET_KEYS = ["file_path", "filePath", "path"];
 
+/** Every header in the V4A patch format that names a file the patch changes. */
+const PATCHED_FILE_HEADER = /^\*\*\* (?:Add|Update|Delete) File: (.+)$/gm;
+
 export interface LedgeredCall {
   toolUseId: string;
   tool: string;
@@ -32,14 +68,104 @@ export interface LedgeredCall {
  * The one reading of a payload both halves share. Asking the same question in
  * two places is how they drift apart, and a drift here is silent: the pre-tool
  * half parks a snapshot the post-tool half never comes to claim.
+ *
+ * A list because a patch call changes a set of files, not one.
  */
-export function ledgeredCall(payload: Record<string, unknown>): LedgeredCall | null {
+export function ledgeredCalls(payload: Record<string, unknown>): LedgeredCall[] {
   const toolUse = normalizeToolUse(payload);
-  const toolUseId = toolUseIdOf(payload);
-  if (!toolUse || !toolUseId) return null;
+  if (!toolUse) return [];
+
+  const patched = patchedTargets(payload, toolUse.toolName);
+  if (patched.length > 0) return patchCalls(payload, toolUse.toolName, patched);
 
   const target = ledgeredTarget(toolUse.toolName, toolUse.toolInput);
-  return target ? { toolUseId, tool: toolUse.toolName, target } : null;
+  if (!target) return [];
+
+  const toolUseId = pairingKeyOf(payload, toolUse.toolName, target);
+  return toolUseId ? [{ toolUseId, tool: toolUse.toolName, target }] : [];
+}
+
+/**
+ * A patch changes several files under one tool call, so the call's own id
+ * cannot key its snapshots — all of them would collide on it and only one would
+ * ever be claimed. Naming the target in the key is what keeps them apart.
+ */
+function patchCalls(
+  payload: Record<string, unknown>,
+  tool: string,
+  targets: string[]
+): LedgeredCall[] {
+  const anchor = toolUseIdOf(payload) ?? sessionOf(payload);
+  if (!anchor) return [];
+  return targets.map((target) => ({
+    toolUseId: derivedPairingKey(anchor, tool, target),
+    tool,
+    target,
+  }));
+}
+
+/**
+ * The files a patch call changes, resolved against the directory the agent ran
+ * it in — a patch names them the way the agent typed them, which is relative.
+ */
+function patchedTargets(payload: Record<string, unknown>, toolName: string): string[] {
+  if (!PATCHING_TOOLS.has(toolName.toLowerCase())) return [];
+
+  const patch = patchBodyOf(payload);
+  if (!patch) return [];
+
+  const base = typeof payload.cwd === "string" ? payload.cwd : process.cwd();
+  return Array.from(patch.matchAll(PATCHED_FILE_HEADER), (match) =>
+    absoluteFrom(base, match[1].trim())
+  );
+}
+
+/** Its arguments are the patch itself, rather than JSON naming a file. */
+function patchBodyOf(payload: Record<string, unknown>): string | null {
+  const args = payload.toolArgs ?? payload.tool_input ?? payload.toolInput;
+  if (typeof args === "string") return args.length > 0 ? args : null;
+  return patchCommandOf(args);
+}
+
+/** Codex carries the patch under a command key instead of sending it as the arguments. */
+function patchCommandOf(args: unknown): string | null {
+  if (typeof args !== "object" || args === null || Array.isArray(args)) return null;
+  const command = (args as Record<string, unknown>).command;
+  return typeof command === "string" && command.length > 0 ? command : null;
+}
+
+function absoluteFrom(base: string, path: string): string {
+  return isAbsolute(path) ? path : resolve(base, path);
+}
+
+/**
+ * Copilot's CLI publishes no id for a tool invocation, so its two halves are
+ * paired on what both do carry. Session, tool and target identify the call
+ * uniquely as long as it does not overlap another write to the same file in
+ * the same session, which sequential tool use cannot produce.
+ */
+function derivedPairingKey(anchor: string, tool: string, target: string): string {
+  const digest = new Bun.CryptoHasher("sha256")
+    .update([anchor, tool, target].join(" "), "utf-8")
+    .digest("hex");
+  return `derived-${digest.slice(0, 32)}`;
+}
+
+function sessionOf(payload: Record<string, unknown>): string | null {
+  const session = payload.sessionId ?? payload.session_id;
+  return typeof session === "string" && session.length > 0 ? session : null;
+}
+
+function pairingKeyOf(
+  payload: Record<string, unknown>,
+  tool: string,
+  target: string
+): string | null {
+  const explicit = toolUseIdOf(payload);
+  if (explicit) return explicit;
+
+  const session = sessionOf(payload);
+  return session ? derivedPairingKey(session, tool, target) : null;
 }
 
 /**
@@ -50,16 +176,28 @@ export function ledgeredCall(payload: Record<string, unknown>): LedgeredCall | n
  * They carry the same fact under different keys, which is the whole reason this
  * mapping is written down in one place rather than read twice.
  */
-const UNAPPLIED_EVENTS: Record<string, { outcome: LedgerOutcome; reasonKey: string }> = {
-  PostToolUseFailure: { outcome: "failed", reasonKey: "error" },
-  PermissionDenied: { outcome: "denied", reasonKey: "reason" },
-};
+const UNAPPLIED_EVENTS: Record<string, { outcome: LedgerOutcome; reasonKeys: string[] }> =
+  {
+    PostToolUseFailure: { outcome: "failed", reasonKeys: ["error"] },
+    PermissionDenied: { outcome: "denied", reasonKeys: ["reason"] },
+    postToolUseFailure: { outcome: "failed", reasonKeys: ["error_message", "error"] },
+  };
+
+function deniedByFailureType(payload: Record<string, unknown>): boolean {
+  return payload.failure_type === "permission_denied";
+}
 
 export interface UnappliedVerdict {
   outcome: LedgerOutcome;
   reason?: string;
 }
 
+/** Copilot names the event nowhere in its payload, so its config says so on argv. */
+function eventFromArgv(): string | undefined {
+  const flag = process.argv.find((a) => a.startsWith("--event="));
+  return flag?.slice("--event=".length) || undefined;
+}
+
 /**
  * What became of a call, for the events that mean it did not land — or nothing
  * when the payload is some other event, so one hook can be registered on both
@@ -68,18 +206,43 @@ export interface UnappliedVerdict {
 export function unappliedVerdictOf(
   payload: Record<string, unknown>
 ): UnappliedVerdict | null {
-  const event = payload.hook_event_name ?? payload.hookEventName;
+  const event = payload.hook_event_name ?? payload.hookEventName ?? eventFromArgv();
   if (typeof event !== "string") return null;
 
   const mapping = UNAPPLIED_EVENTS[event];
   if (!mapping) return null;
 
-  const reason = payload[mapping.reasonKey];
-  // A reason the runtime did not send is left absent rather than invented: an
-  // entry that states a cause it does not have is worse than one that admits none.
-  return typeof reason === "string" && reason.length > 0
-    ? { outcome: mapping.outcome, reason }
-    : { outcome: mapping.outcome };
+  const outcome = deniedByFailureType(payload) ? "denied" : mapping.outcome;
+  const reason = mapping.reasonKeys
+    .map((key) => payload[key])
+    .find((value): value is string => typeof value === "string" && value.length > 0);
+  return reason ? { outcome, reason } : { outcome };
+}
+
+function contentsOf(path: string): string | null {
+  return existsSync(path) ? readFileSync(path, "utf-8") : null;
+}
+
+/** Park the target's current contents, the last moment they still exist. */
+export function snapshotCall(call: LedgeredCall): void {
+  savePending({ ...call, before: contentsOf(call.target), ts: new Date().toISOString() });
+}
+
+/** Pair a parked before-state with the result, or nothing if none was parked. */
+export function commitApplied(call: LedgeredCall): LedgerEntry | null {
+  const pending = claimPending(call.toolUseId);
+  if (!pending) return null;
+
+  const entry = recordAction({
+    tool: pending.tool,
+    target: pending.target,
+    outcome: "applied",
+    before: pending.before,
+    beforeState: pending.beforeState,
+    after: contentsOf(call.target),
+  });
+  reapStalePending();
+  return entry;
 }
 
 export function toolUseIdOf(payload: Record<string, unknown>): string | null {
@@ -90,6 +253,11 @@ export function toolUseIdOf(payload: Record<string, unknown>): string | null {
   return null;
 }
 
+function readsRatherThanChanges(toolInput: Record<string, unknown>): boolean {
+  const command = toolInput.command;
+  return typeof command === "string" && READING_COMMANDS.has(command);
+}
+
 /**
  * The absolute path this call will change, or nothing if the call is not one
  * the ledger records.
@@ -99,6 +267,7 @@ export function ledgeredTarget(
   toolInput: Record<string, unknown>
 ): string | null {
   if (!LEDGERED_TOOLS.has(toolName.toLowerCase())) return null;
+  if (readsRatherThanChanges(toolInput)) return null;
   for (const key of TARGET_KEYS) {
     const value = toolInput[key];
     if (typeof value === "string" && value.length > 0) return value;

package/src/hooks/lib/ledger.ts

@@ -35,6 +35,7 @@ import { calcPatch } from "fast-myers-diff";
 import { currentAttribution, type RecordAttribution } from "./actor";
 import { encodeAnchor } from "./anchor";
 import { ensureDir, paths } from "./paths";
+import { isSensitivePath } from "./sensitive-path";
 
 /**
  * What became of the action.
@@ -82,6 +83,8 @@ export interface LedgerDelta {
   hunks: LedgerHunk[];
   /** Set when the change itself was too large to keep. Its absence means the hunks are complete. */
   truncated?: boolean;
+  /** Set when the target is one whose contents the ledger never keeps. */
+  redacted?: boolean;
 }
 
 export interface LedgerEntry extends RecordAttribution {
@@ -111,8 +114,10 @@ export interface RecordActionInput {
   /** Absolute path of the file the action targeted. */
   target: string;
   outcome: LedgerOutcome;
-  /** Prior content; null for a file creation. */
+  /** Prior content; null for a file creation, and withheld for a sensitive target. */
   before: string | null;
+  /** Identity of the prior content, when the content itself was withheld. */
+  beforeState?: LedgerState;
   /** Resulting content; null when nothing landed. */
   after: string | null;
   reason?: string;
@@ -156,6 +161,13 @@ function toLines(content: string | null): string[] {
  * The change between two states, or nothing when there was no transition to
  * describe. An action that did not land has no delta — see LedgerEntry.delta.
  */
+const WITHHELD: LedgerDelta = { hunks: [], redacted: true };
+
+function deltaFor(input: RecordActionInput): LedgerDelta | undefined {
+  if (isSensitivePath(input.target)) return WITHHELD;
+  return deltaOf(input.before, input.after);
+}
+
 function deltaOf(before: string | null, after: string | null): LedgerDelta | undefined {
   if (after === null) return undefined;
 
@@ -180,7 +192,7 @@ function deltaOf(before: string | null, after: string | null): LedgerDelta | und
  * side of the ledger — a stored change is only evidence if it can be replayed.
  */
 export function applyDelta(before: string | null, delta: LedgerDelta): string | null {
-  if (delta.truncated) return null;
+  if (delta.truncated || delta.redacted) return null;
 
   const lines = toLines(before);
   const out: string[] = [];
@@ -230,7 +242,7 @@ function freeArchivePath(stamp: string): string {
  * being asked of it.
  */
 export function recordAction(input: RecordActionInput): LedgerEntry {
-  const delta = deltaOf(input.before, input.after);
+  const delta = deltaFor(input);
   const entry: LedgerEntry = {
     id: generateId(),
     ts: new Date().toISOString(),
@@ -238,7 +250,7 @@ export function recordAction(input: RecordActionInput): LedgerEntry {
     tool: input.tool,
     target: encodeAnchor(input.target),
     outcome: input.outcome,
-    before: stateOf(input.before),
+    before: input.beforeState ?? stateOf(input.before),
     after: stateOf(input.after),
     ...(delta ? { delta } : {}),
     ...(input.reason ? { reason: input.reason } : {}),
@@ -262,6 +274,7 @@ export interface PendingSnapshot {
   tool: string;
   target: string;
   before: string | null;
+  beforeState?: LedgerState;
   ts: string;
 }
 
@@ -281,8 +294,15 @@ function pendingPath(toolUseId: string): string {
   return resolve(pendingDir(), `${toolUseId.replace(/[^A-Za-z0-9_-]/g, "")}.json`);
 }
 
+function withheldWhenSensitive(snapshot: PendingSnapshot): PendingSnapshot {
+  if (snapshot.before === null || !isSensitivePath(snapshot.target)) return snapshot;
+  const state = stateOf(snapshot.before);
+  return { ...snapshot, before: null, ...(state ? { beforeState: state } : {}) };
+}
+
 export function savePending(snapshot: PendingSnapshot): void {
-  writeFileSync(pendingPath(snapshot.toolUseId), JSON.stringify(snapshot), "utf-8");
+  const withheld = withheldWhenSensitive(snapshot);
+  writeFileSync(pendingPath(withheld.toolUseId), JSON.stringify(withheld), "utf-8");
 }
 
 /**

package/src/hooks/lib/sensitive-path.ts

@@ -0,0 +1,117 @@
+/**
+ * Paths whose contents the ledger notes the change of but never keeps.
+ *
+ * The floor below is fixed in code rather than configured: a denylist a user can
+ * shrink is a suggestion, and settings may only add to this one. That direction
+ * also makes a malformed user pattern harmless — the worst it can do is redact
+ * something it did not need to.
+ */
+
+import { raw } from "./settings";
+
+const ENV_TEMPLATE_SUFFIXES = [".sample", ".example", ".template", ".dist", ".defaults"];
+
+/** Matched whole: `id_*` would catch `id_generator.ts`, `credentials*` a test file. */
+const SECRET_FILENAMES = new Set([
+  ".npmrc",
+  ".netrc",
+  "_netrc",
+  ".pgpass",
+  ".htpasswd",
+  ".envrc",
+  "credentials",
+  "id_rsa",
+  "id_dsa",
+  "id_ecdsa",
+  "id_ecdsa_sk",
+  "id_ed25519",
+  "id_ed25519_sk",
+]);
+
+const SECRET_EXTENSIONS = [
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".keystore",
+  ".jks",
+  ".asc",
+  ".gpg",
+  ".kdbx",
+];
+
+const SECRET_DIRECTORIES = new Set([
+  ".ssh",
+  ".gnupg",
+  ".aws",
+  ".docker",
+  ".kube",
+  ".gcloud",
+  ".azure",
+]);
+
+const SECRET_DIRECTORY_PAIRS = [
+  [".config", "gh"],
+  [".config", "gcloud"],
+  [".local", "share/keyrings"],
+];
+
+function segmentsOf(path: string): string[] {
+  return path.split(/[/\\]/).filter(Boolean);
+}
+
+function isLiveDotenv(name: string): boolean {
+  if (name !== ".env" && !name.startsWith(".env.")) return false;
+  return !ENV_TEMPLATE_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+
+function isSecretFilename(name: string): boolean {
+  return SECRET_FILENAMES.has(name);
+}
+
+function hasSecretExtension(name: string): boolean {
+  return SECRET_EXTENSIONS.some((ext) => name.toLowerCase().endsWith(ext));
+}
+
+function inSecretDirectory(dirs: string[]): boolean {
+  if (dirs.some((dir) => SECRET_DIRECTORIES.has(dir))) return true;
+  return SECRET_DIRECTORY_PAIRS.some(([parent, child]) =>
+    dirs.some(
+      (dir, i) =>
+        dir === parent &&
+        dirs
+          .slice(i + 1)
+          .join("/")
+          .startsWith(child)
+    )
+  );
+}
+
+function userPatterns(): string[] {
+  const configured = raw().ledger?.redactPaths;
+  if (!Array.isArray(configured)) return [];
+  return configured.filter(
+    (pattern) => typeof pattern === "string" && pattern.length > 0
+  );
+}
+
+function matchesUserPattern(path: string, name: string): boolean {
+  return userPatterns().some((pattern) => {
+    const glob = new Bun.Glob(pattern);
+    return glob.match(path) || glob.match(name);
+  });
+}
+
+/** Should this file's contents be withheld from the ledger? */
+export function isSensitivePath(path: string): boolean {
+  const segments = segmentsOf(path);
+  const name = segments.at(-1) ?? "";
+  const dirs = segments.slice(0, -1);
+  return (
+    inSecretDirectory(dirs) ||
+    isLiveDotenv(name) ||
+    isSecretFilename(name) ||
+    hasSecretExtension(name) ||
+    matchesUserPattern(path, name)
+  );
+}

package/src/hooks/lib/settings.ts

@@ -25,6 +25,11 @@ export interface PalSettingsData {
   dynamicContext?: Record<string, boolean>;
   /** Git co-author attribution opt-in. `decided` gates the one-time prompt. */
   attribution?: { enabled?: boolean; decided?: boolean };
+  /**
+   * Action-ledger user extension. `redactPaths` adds to the built-in set of
+   * paths whose contents are never stored; it cannot shrink it.
+   */
+  ledger?: { redactPaths?: string[] };
   /** Contextual-steering user extension: personal rules + shipped rules to suppress by tag. */
   steering?: {
     disable?: string[];

package/src/targets/lib.ts

@@ -472,7 +472,21 @@ export function unmergeCursorHooks(
 
 type CodexHookCommand = { type: string; command: string; timeout?: number };
 type CodexHookGroup = { matcher?: string; hooks: CodexHookCommand[] };
-type CodexHooks = { hooks?: Record<string, CodexHookGroup[]> };
+type CodexHooks = {
+  hooks?: Record<string, CodexHookGroup[]>;
+  description?: string;
+  version?: unknown;
+};
+
+/**
+ * Codex parses hooks.json strictly and accepts only `description` and `hooks`.
+ * A stale `version` makes it reject the whole file — every PAL hook silently
+ * stops — and merging preserves what it finds, so it must be dropped by name.
+ */
+function withoutRejectedFields(config: CodexHooks): CodexHooks {
+  const { version: _version, ...accepted } = config;
+  return accepted;
+}
 
 /**
  * Normalize a PAL hook command for cross-path deduplication.
@@ -542,7 +556,7 @@ function stripPalHooks(
 
 /** Merge PAL hooks into an existing Codex hooks.json. Deduplicates by canonical command path. */
 export function mergeCodexHooks(existing: CodexHooks, template: CodexHooks): CodexHooks {
-  const result: CodexHooks = { ...existing };
+  const result: CodexHooks = withoutRejectedFields(existing);
   if (!template.hooks) return result;
   result.hooks ??= {};
 
@@ -561,7 +575,7 @@ export function unmergeCodexHooks(
   existing: CodexHooks,
   template: CodexHooks
 ): CodexHooks {
-  const result: CodexHooks = { ...existing };
+  const result: CodexHooks = withoutRejectedFields(existing);
   if (!template.hooks || !result.hooks) return result;
 
   stripPalHooks(result.hooks, collectPalCanonical(template));

package/src/targets/opencode/plugin.ts

@@ -106,6 +106,14 @@ const PALPlugin: Plugin = async ({ directory, client }: PluginInput) => {
   const { isPalSpawnedInference } =
     await lib<typeof import("../../hooks/lib/spawn-guard")>("spawn-guard.ts");
 
+  const { commitApplied, ledgeredTarget, snapshotCall } =
+    await lib<typeof import("../../hooks/lib/ledger-hook")>("ledger-hook.ts");
+
+  const ledgeredOpencodeCall = (tool: string, callID: string, args: unknown) => {
+    const target = ledgeredTarget(tool, (args ?? {}) as Record<string, unknown>);
+    return target ? { toolUseId: callID, tool, target } : null;
+  };
+
   return {
     // --- Per-message: Inject dynamic system reminder ---
     "experimental.chat.system.transform": async (_input, output) => {
@@ -213,6 +221,20 @@ const PALPlugin: Plugin = async ({ directory, client }: PluginInput) => {
           throw new Error(`PAL Security: ${fileReason}`);
         }
       }
+
+      const call = ledgeredOpencodeCall(toolName, _input.callID, output.args);
+      if (call) snapshotCall(call);
+    },
+
+    "tool.execute.after": async (
+      input: { tool: string; sessionID: string; callID: string; args: unknown },
+      _output: { title: string; output: string; metadata: unknown }
+    ) => {
+      const call = ledgeredOpencodeCall(input.tool, input.callID, input.args);
+      if (!call) return;
+
+      const entry = commitApplied(call);
+      if (entry) logDebug("opencode:ledger", `recorded ${entry.id} ${entry.target}`);
     },
 
     // --- Inject PAL_DIR into shell environment ---

package/src/tools/agent/project.ts

@@ -392,11 +392,36 @@ interface Isc {
   status: IscStatus;
 }
 
+/**
+ * An ISC is one markdown line, so a newline in its text would end the record
+ * and strand every paragraph after it as unparseable debris. Backslashes are
+ * escaped first so that decoding a literal "\n" in a regex cannot be mistaken
+ * for the separator.
+ */
+function encodeIscText(text: string): string {
+  return text
+    .replaceAll("\\", "\\\\")
+    .replaceAll("\r\n", "\n")
+    .replaceAll("\r", "\n")
+    .replaceAll("\n", "\\n");
+}
+
+const ISC_UNESCAPE: Record<string, string> = { n: "\n", "\\": "\\" };
+
+function decodeIscText(stored: string): string {
+  return stored.replaceAll(/\\(.)/g, (whole, ch) => ISC_UNESCAPE[ch] ?? whole);
+}
+
 function parseIscs(criteria: string): Isc[] {
   const out: Isc[] = [];
   for (const line of criteria.split("\n")) {
     const m = new RegExp(/^-\s+\[( |x|~)\]\s+ISC-(\d+):\s+(.+)$/i).exec(line);
-    if (m) out.push({ id: Number(m[2]), text: m[3].trim(), status: statusFromBox(m[1]) });
+    if (m)
+      out.push({
+        id: Number(m[2]),
+        text: decodeIscText(m[3].trim()),
+        status: statusFromBox(m[1]),
+      });
   }
   return out;
 }
@@ -471,7 +496,7 @@ function cmdAddIsc(args: string[]): void {
   const p = requireProject(name);
   const current = p.criteria ?? "";
   const id = nextIscId(p);
-  const newLine = `- [ ] ISC-${id}: ${title}`;
+  const newLine = `- [ ] ISC-${id}: ${encodeIscText(title)}`;
   p.criteria = current ? `${current.trimEnd()}\n${newLine}` : newLine;
   p.updated = now();
   writeProject(p);
@@ -628,7 +653,7 @@ function cmdEditIsc(args: string[]): void {
       .split("\n")
       .map((l) =>
         new RegExp(String.raw`^-\s+\[[ x~]\]\s+ISC-${id}:`, "i").test(l)
-          ? `- ${box} ISC-${id}: ${text}`
+          ? `- ${box} ISC-${id}: ${encodeIscText(text)}`
           : l
       )
       .join("\n");